php7.0: CVE-2017-5340: Use of uninitialized memory in unserialize()

Debian Bug report logs - #850158
php7.0: CVE-2017-5340: Use of uninitialized memory in unserialize()

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Henri Salo <henri@nerv.fi>

To: submit@bugs.debian.org

Subject: Use of uninitialized memory in unserialize()

Date: Wed, 4 Jan 2017 15:53:37 +0200

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Package: php7.0
Version: 7.0.14-2
Severity: important
Tags: security, upstream, fixed-upstream

There was found a bug showing that PHP uses uninitialized memory during calls to
`unserialize()`. As the following report shows, the payload supplied to
`unserialize()` may control this uninitialized memory region and thus may be
used to trick PHP into operating on faked objects and calling attacker
controlled destructor function pointers. The supplied proof of concept exploit
practically demonstrates the issue by executing arbitrary code solely by passing
a specially crafted string to `unserialize()`. Even though this particular demo
exploit only works locally this flaw is very likely to also allow for remote
code execution.

Upstream bug report for additional details: https://bugs.php.net/bug.php?id=73832
Fix: https://gist.github.com/anonymous/9fbe5ccbe8e18659bec11ac963fd07a3

- -- 
Henri Salo
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBAgAGBQJYbP5hAAoJECet96ROqnV0rmIP/j0HpcNDEpNJTeR+JN75jC90
quuTqH98Neibb3WZEHHHksFVbKohmDm/KVQ1E7AWe6+zZ4FfEoPOsBkhoK2Swfv0
VTB7NVKFhlqmPwnVaB3l/6fc58mtyy6ljPcd/KIr1n3DCRbHgo13QmsgHBFSoqMs
WhJ0CB4NR87/qGqmuHabT1wkzwIB90uApbwBlDRpPTA54XWLRPoIZNlb3roh8RGD
lVb9Nb5vUZMGbrL376r6PkL+sZ6QcKemrGF3ZZqiirKcCfstYzhuftPgGLIGc0B2
Ud3IcH5wjxd/h4s4DA9SjZwnYbOlt76e3kcZbUZ4rJF1SEUAr0hfjRcbrEEj/0Ni
5B/z5H+miK4xAy+gyYemKELWhyrjSE5n2f5rN0SEJtTiaoF2XESLFP8HsuVzZyox
KOte7ekNIX0Ev+UvmEGeXawlqKRR+xuIYfS9obpgtbWYOZa1zdKMJz8VFfSun2MQ
9aK5B6icbeGTjB+ilKINv7UqLXArZw4WokAVBKRFXRpdAOjBBdGp9u0lIp2vNcru
hM6wc/lXShs7JlpQ3Rx0OMSv48u94NwwUw+otJcBg7lc5BoGlQSTqIObIUk4uuyY
abCYVpGBQN/qzGB/lULpt4ExxHEzDHC3pRimBGM6vGdThXOHKFi4VwlMf39UXaLl
rxvwtgdjnNAafVGc/H4g
=lHoz
-----END PGP SIGNATURE-----

Message #12 received at 850158@bugs.debian.org (full text, mbox, reply):

From: Ondřej Surý <ondrej@sury.org>

To: Henri Salo <henri@nerv.fi>, 850158@bugs.debian.org, Debian Security Team <team@security.debian.org>

Subject: Re: [php-maint] Bug#850158: Use of uninitialized memory in unserialize()

Date: Wed, 04 Jan 2017 15:24:22 +0100

Hi,

any web application that allows passing unsanitized data to
unserialize() is doomed, so I don't really think that this requires
immediate attention.

This will get fixed in a normal security cycle with next PHP release (or
I'll add the patch on top of next release).

Cheers,
-- 
Ondřej Surý <ondrej@sury.org>
Knot DNS (https://www.knot-dns.cz/) – a high-performance DNS server
Knot Resolver (https://www.knot-resolver.cz/) – secure, privacy-aware,
fast DNS(SEC) resolver
Vše pro chleba (https://vseprochleba.cz) – Mouky ze mlýna a potřeby pro
pečení chleba všeho druhu

On Wed, Jan 4, 2017, at 14:53, Henri Salo wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> Package: php7.0
> Version: 7.0.14-2
> Severity: important
> Tags: security, upstream, fixed-upstream
> 
> There was found a bug showing that PHP uses uninitialized memory during
> calls to
> `unserialize()`. As the following report shows, the payload supplied to
> `unserialize()` may control this uninitialized memory region and thus may
> be
> used to trick PHP into operating on faked objects and calling attacker
> controlled destructor function pointers. The supplied proof of concept
> exploit
> practically demonstrates the issue by executing arbitrary code solely by
> passing
> a specially crafted string to `unserialize()`. Even though this
> particular demo
> exploit only works locally this flaw is very likely to also allow for
> remote
> code execution.
> 
> Upstream bug report for additional details:
> https://bugs.php.net/bug.php?id=73832
> Fix: https://gist.github.com/anonymous/9fbe5ccbe8e18659bec11ac963fd07a3
> 
> - -- 
> Henri Salo
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1
> 
> iQIcBAEBAgAGBQJYbP5hAAoJECet96ROqnV0rmIP/j0HpcNDEpNJTeR+JN75jC90
> quuTqH98Neibb3WZEHHHksFVbKohmDm/KVQ1E7AWe6+zZ4FfEoPOsBkhoK2Swfv0
> VTB7NVKFhlqmPwnVaB3l/6fc58mtyy6ljPcd/KIr1n3DCRbHgo13QmsgHBFSoqMs
> WhJ0CB4NR87/qGqmuHabT1wkzwIB90uApbwBlDRpPTA54XWLRPoIZNlb3roh8RGD
> lVb9Nb5vUZMGbrL376r6PkL+sZ6QcKemrGF3ZZqiirKcCfstYzhuftPgGLIGc0B2
> Ud3IcH5wjxd/h4s4DA9SjZwnYbOlt76e3kcZbUZ4rJF1SEUAr0hfjRcbrEEj/0Ni
> 5B/z5H+miK4xAy+gyYemKELWhyrjSE5n2f5rN0SEJtTiaoF2XESLFP8HsuVzZyox
> KOte7ekNIX0Ev+UvmEGeXawlqKRR+xuIYfS9obpgtbWYOZa1zdKMJz8VFfSun2MQ
> 9aK5B6icbeGTjB+ilKINv7UqLXArZw4WokAVBKRFXRpdAOjBBdGp9u0lIp2vNcru
> hM6wc/lXShs7JlpQ3Rx0OMSv48u94NwwUw+otJcBg7lc5BoGlQSTqIObIUk4uuyY
> abCYVpGBQN/qzGB/lULpt4ExxHEzDHC3pRimBGM6vGdThXOHKFi4VwlMf39UXaLl
> rxvwtgdjnNAafVGc/H4g
> =lHoz
> -----END PGP SIGNATURE-----
> 
> _______________________________________________
> pkg-php-maint mailing list
> pkg-php-maint@lists.alioth.debian.org
> http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/pkg-php-maint

Message #17 received at 850158@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Ondřej Surý <ondrej@sury.org>

Cc: Henri Salo <henri@nerv.fi>, 850158@bugs.debian.org, Debian Security Team <team@security.debian.org>

Subject: Re: [php-maint] Bug#850158: Use of uninitialized memory in unserialize()

Date: Wed, 4 Jan 2017 17:13:09 +0100

Hi Ondřej

On Wed, Jan 04, 2017 at 03:24:22PM +0100, Ondřej Surý wrote:
> Hi,
> 
> any web application that allows passing unsanitized data to
> unserialize() is doomed, so I don't really think that this requires
> immediate attention.
> 
> This will get fixed in a normal security cycle with next PHP release (or
> I'll add the patch on top of next release).

Yes that sounds fine.

Regards,
Salvatore

Message #22 received at 850158@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Henri Salo <henri@nerv.fi>, 850158@bugs.debian.org

Subject: Re: Bug#850158: Use of uninitialized memory in unserialize()

Date: Wed, 11 Jan 2017 08:19:30 +0100

Control: retitle -1 php7.0: CVE-2017-5340: Use of uninitialized memory in unserialize()

Hi

MITRE had assigned  CVE-2017-5340 for this issue. Can you add the CVE
reference to the upstream bug?

Regards,
Salvatore

Message #35 received at 850158-submitter@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: control@bugs.debian.org

Cc: 850158-submitter@bugs.debian.org

Subject: closing 850158

Date: Wed, 25 Jan 2017 13:14:49 +0100

close 850158 7.0.15-1
thanks

Send a report that this bug log contains spam.